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abstract  The  purpose  of  this  study  was  to  demonstrate  a  method 
of  calculating  the  probability  of  human  errors  during  prelaunch 
testing  Completion  of  studies  described  herein  will  permit  the 
following  statements:  (a)  The  probability  that  the  test  can  be 
completed  without  human  error,  (b)  The  probability  that  human 
errors  will  remain  undiscovered,  (c)  The  probability  that  undis- 
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In  addition  to  a  reliability  number  for  the  total  test,  such  studies 
will  provide  a  breakdown  of  reliabilities  for  all  human  tasks  in  the 
test.  Areas  of  greatest  risk  can  then  be  pinpointed  and  corrective 
efforts  focused  on  them.  A  proposed  method  for  calculating  sys¬ 
tem  reliability  is  described.  Development  and  application  of  this 
method  will  permit  assessment  of  the  contribution  of  each  pre¬ 
flight  test  to  over-all  system  reliability,  and  will  also  point  out 
the  need  for  adding  or  removing  tests.  This  method  takes  into 
account  the  probabilities:  (a)  that  the  hardware  was  manufactured 
correctly,  (b)  that  the  hardware  will  not  be  damaged  by  human 
handling,  (c)  that  the  tests  administered  to  the  hardware  will  re¬ 
veal  all  malfunctions,  and  (d)  the  inherent  reliability  of  the  hard¬ 
ware.  Reliability  thus  determined  would  be  a  function  of  the 
following:  R  =  f  (Cl)  where  R  =  reliability,  C  =  confidence,  and 
I  =  inherent  reliability 


By  cutting  out  thu  rectangle  and  folding  on  the  canter  line,  the  above  information  can  ba  fitted 

into  a  itandard  card  file. 


ABSTRACT 


The  purpose  of  the  study  reported  herein  was  to  demonstrate  a  method  of  calculating 
the  probability  of  human  errors  during  prelaunch  testing  activities.  Completion  of 
the  studies  described  in  this  report  will  permit  statements  of  the  following  type 

a.  The  probability  that  the  test  can  be  completed  without  human  error. 

b.  The  probability  that  human  errors  will  remain  undiscovered. 

c.  The  probability  that  undiscovered  errors  will  result  in  failures. 

In  addition  to  a  reliability  number  for  the  total  test,  such  studies  will  provide  a 
breakdown  of  reliabilities  for  all  human  tasks  in  the  test.  With  this  breakdown, 
areas  of  greatest  risk  can  be  pinpointed  and  corrective  efforts  can  be  focused  on 
them. 

Section  3  of  this  report  describes  a  proposed  method  for  calculating  system  relia¬ 
bility.  Development  and  application  of  this  technique  will  permit  assessment  of  the 
contribution  of  each  preflight  test  towards  over-all  system  reliability.  It  will  also 
point  out  the  need  for  adding  or  removing  tests  from  the  testing  cycle. 

This  method  takes  into  account:  (a)  the  probability  that  the  hardware  was  manu¬ 
factured  correctly,  (b)  the  probability  that  the  hardware  will  not  be  damaged  by 
human  handling,  (c)  the  probability  that  the  tests  administered  to  the  hardware  will 
reveal  all  malfunctions,  and  (d)  the  inherent  reliability  of  the  hardware.  Reliability 
determined  by  this  scheme  would  be  a  function  of  the  following  formula 

R  =  f(CI) 

where  R  =  reliability,  C  =  confidence,  I  =  inherent  reliability. 
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SECTION  1 
INTRODUCTION 

The  purpose  of  this  report  is  to  describe  a  technique  which  permits  the  quantification 
of  human  reliability  Use  of  this  technique  will  permit  one  to  assess  the  consequences 
of  human  error  on  system  effectiveness  and  to  identify  human  tasks  contributing  the 
most  to  human  unreliability 

The  basic  goal  of  human  factors  effort  is  to  improve  human  efficiency  This  is  done 
in  three  ways:  human  engineering  of  equipment,  design  of  procedures,  and  training. 
The  basic  function  of  a  human  factors  program  is  to  predict  problems  involving  the 
interface  between  man  and  machine.  In  the  past,  human  factors  personnel  have  made 
use  of  laboratory  research  results  in  a  qualitative  manner.  In  other  words,  state¬ 
ments  were  made  to  the  effect  that  one  condition  is  better  than  another  without 
qualification  as  to  just  how  much  better.  The  techniques  described  in  this  report 
will  permit  quantitative  predictions  about  human  error  rates. 

There  have  been  many  attempts  in  the  past  to  evaluate  the  human  part  of  a  system. 
Most  of  these  attempts  have  resulted  in  qualitative  methods  of  evaluation  For  a 
short  review  of  these  efforts,  see  the  first  chapter  of  Payne  and  Altman  (Reference  2). 

The  first  method  of  actually  quantifying  human  performance  was  devised  in  1962 
by  Payne  and  Altman  (Reference  2)  Their  method  was  devised  to  obtain  an  Index 
of  Electronic  Equipment  Operability,  and  resulted  in  a  central  data  store  of  reliability 
information  regarding  a  large  number  of  task  elements  (See  Appendix  A).  By 
recombining  these  elements,  it  is  possible  to  obtain  the  probability  for  successful 
completion  of  almost  any  operator  task.  Payne  and  Altman's  technique  is  usually 
referred  to  as  DATA  STORE. 


A  few  months  later,  L  W.  Rook  (Reference  4)  reported  on  a  somewhat  similar 
method  In  use  at  the  Sandia  Corporation.  Rook's  work  applied  primarily  to  industrial 
production.  Where  Payne  and  Altman  obtained  reliability  data  from  laboratory 
studies,  Rook  made  use  of  records  from  actual  industrial  practice.  Another 
difference  in  the  techniques  is  that  Payne  and  Altman  provide  data  on  the  probability 
of  a  human  error,  whereas  Rook  extends  his  data  to  the  probability  of  a  human  error 
plus  the  probability  that  this  error  will  result  in  a  failure. 

About  one  year  later,  A  O.  Swain  (Reference  6)  published  an  extension  of  Rook's 
work.  The  extension  was  titled  "Technique  for  Human  Error  Rate  Prediction"  or 
THERP  for  short.  THERP  was  intended  primarily  to  predict  the  consequences  of 
human  error  during  military  operations  (see  Appendix  A).  The  use  of  THERP 
techniques  permits  the  combination  of  hardware  reliabilities  with  human  reliabilities 
to  determine  the  effects  of  human  error  on  system  performance 

The  present  paper  is  an  extension  of  the  above  techniques  into  the  area  of  system 
testing  during  a  manufacturing  cycle. 
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SECTION  2 

DESCRIPTION  OF  THE  STUDY 


2.1  OBJECTIVE 


The  basic  objective  of  this  study  was  to  demonstrate,  in  a  concrete  manner,  the 
feasibility  of  using  DATA  STORE  and  THERP  for  test  activities. 

2.2  BACKGROUND 


Before  presenting  a  description  of  the  current  study,  perhaps  a  brief  explanation 
of  the  context  in  which  the  study  was  performed  is  in  order. 

During  the  manufacturing  cycle  of  a  space  vehicle,  certain  tests  are  performed  at 
given  points.  In  general,  there  are  three  levels  of  testing:  component,  subsystem, 
and  system.  Component  tests  are  designed  to  weed  out  all  malfunctioning  parts 
just  after  manufacture;  upon  completion  of  component  testing,  the  parts  are  assembled 
into  subsystems.  Subsystem  tests  are  then  administered  to  find  errors  and  mal¬ 
functions  that  have  occurred  during  subsystem  assembly  as  well  as  to  determine  sub¬ 
system  functional  compatibility.  After  successful  completion  of  these  teste,  the 
entire  vehicle  is  assembled  and  given  a  system  test  to  ensure  that  the  subsystems 
are  functionally  compatible  and  that  no  errors  or  malfunctions  have  been  introduced 
during  the  assembly  process.  When  these  tests  are  completed  the  vehicle  is  shipped 
to  the  Pal  and  is  launched. 

To  conduct  this  study,  a  short  human  task  was  required  which  had  a  well -documented 
reliability  history  so  that  validation  of  the  findings  would  be  possible.  The  subsystem 
test  for  a  pneumatic  stabilization  subsystem  was  chosen  because  it  met  the  above 
criteria  and  involved  primarily  console  activities  which  could  be  analyzed  more  easily 
than  other  operations.  The  poeumatics  system  is  packaged  go  a  bulkhead  that  is 


3 


installed  on  the  vehicle  when  the  stabilization  subsystem  test  has  been  completed. 
After  installation  in  the  vehicle,  the  pneumatics  system  is  tested  twice  more  once 
during  the  system  test  and  again  during  the  field  cycle  prior  to  launch.  These  sub* 
sequent  checks  will  provide  validation  evidence  for  the  method  under  study,  i.e. , 
quantification  of  human  performance. 

2.3  SEQUENCE  OF  EVENTS 

2.3  1  TASK  ANALYSIS 

After  selection  of  the  task  to  be  analyzed,  a  complete  and  accurate  task  analysis 
was  required  Subsystem  tests  are  described  step  by  step  in  a  document  called  a 
Standing  Instruction  (SI);  this  SI  was  used  as  a  starting  place  for  the  task  analysis. 

It  was  believed,  however,  that  the  SI  was  not  sufficiently  detailed  for  a  DATA  STORE 
type  analysis  and  so  further  study  was  required  to  add  sufficient  detail.  Several 
visits  were  made  to  the  pneumatics  test  cell  to  observe  activities  and  talk  with 
test  personnel  in  order  to  become  familiar  with  the  human  actions  involved  in  the 
test.  Dry  runs  of  the  test  were  witnessed  and  appropriate  corrections  and  additions 
were  incorporated  into  the  task  analysis  as  a  result.  The  final  activity  in  the  test 
cell  was  an  observation  of  an  actual  test  of  the  pneumatics  subsystem.  Following 
this  event,  a  final  version  of  the  task  analysis  was  written  and  reviewed  by  test 
personnel. 

2.3.2  INDEPENDENT  TASK  RELIABILITIES 

Upon  completion  of  the  task  analysis,  the  next  required  action  was  the  assignment 
of  reliabilities  to  the  task  elements.  This  was  accomplished  through  use  of  the 
DATA  STORE  (See  Appendix  B.)  In  some  instances,  DATA  STORE  values  did 
not  seem  appropriate  for  the  specific  situation  in  which  they  were  being  applied 
In  these  cases,  changes  were  made  to  the  DAT*  STORE  values  on  the  basis  of 
"expert"  iudgment. 
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2.3.3  COMBINATION  OF  RELIABILITIES  INTO  ONE  FIGURE 


After  Individual  steps  in  the  task  analysis  had  been  evaluated,  the  process  of  combin¬ 
ing  these  numbers  into  a  single  figure  for  the  total  test  was  begun.  Use  of  the 
procedures  recommended  in  DATA  STORE  assumes  that  all  events  in  the  test  are 
Independent  of  each  other.  This  seen.ed  to  be  the  case  in  many  of  the  steps  but  not 
in  all  of  them  In  those  instances  where  tasks  were  not  independent,  the  success 
probabilities  of  tasks  were  modified  to  reflect  the  true  situation  Combination  of 
the  individual  task  reliabilities  into  a  single  success  probability  for  the  total  test 
gave  an  estimate  of  correct  "first  trial"  performance,  i.e.  ,  the  probability  of  not 
making  a  single  human  error. 

2.3.  4  PROBABILITY  OF  ERROR  CORRECTION 

The  next  step  was  the  evaluation  of  the  effects  of  operator  error# .  To  do  this,  each 
step  in  the  task  analysis  was  reviewed  with  a  Quality  Control  engineer  to  evaluate 
what  types  of  errors  were  possible  and  what  their  effects  would  be.  In  general, 
operator  errors  are  one  of  three  types  those  that  are  caught  by  the  operator  because 
he  cannot  continue  the  test,  those  that  affect  the  recording  made  during  the  test  and 
as  such  can  be  caught  by  the  man  checking  that  record  after  the  test;  and  those  that 
go  undetected  until  some  later  point  in  the  test  cycle,  or  that  result  in  a  mission 
failure  Analysis  of  the  effects  of  operator  error  revealed  that  the  greater  majority 
of  human  errors  in  the  test  would  be  caught  and  corrected  by  the  operator  himself. 

The  result  of  these  types  of  errors  is  an  increase  in  test  time  to  obtain  the  proper 
data. 


In  twelve  instances,  the  probability  of  the  operator  correcting  his  error  was  less 
than  a  certainty,  i.e. ,  the  error  might  go  undetected  (see  Table  2,  page  10).  The  engineer 
examining  the  test  record  usually  has  a  high  probability  of  detecting  errors  missed 
by  the  operator.  In  two  instances,  however,  no  evidence  of  operator  error  is  present 
until  some  later  point  in  the  test  cycle  after  the  subsystem  has  been  assembled  on  the 


vehicle 


5 


In  summary  then,  there  are  three  methods  of  correcting  operator  errors  self 
correction  by  the  operator;  correction  by  the  man  reading  the  oscillograph  record, 
and  correction  by  some  test  later  in  the  cycle  If  the  operator  corrects  his  own 
error  there  is  little  or  no  effect  on  vehicle  reliability.  If  the  man  reading  the 
record  finds  an  operator  error,  the  test  must  be  repeated.  If  a  faulty  valve  or 
regulator  is  discovered  after  mating  to  the  vehicle,  a  delay  is  incurred  that  is 
much  more  expensive  in  both  time  and  money. 


2  3  5  COMBINATION  WITH  HARDWARE  RELIABILITIES 

When  one  calculates  the  probability  of  human  error,  he  is  essentially  determining 
the  probability  that  a  given  test  will  be  conducted  properly  Because  of  this,  human 
errors  by  themselves  do  not  affect  system  success  or  failure.  A  human  error  can 
have  serious  consequences  only  if  the  man  can  damage  the  system  by  poor  test 
techniques  or  if.as  a  result  of  poor  test  technique,  he  fails  to  discover  a  malfunction 
ing  part. 

To  properly  evaluate  the  effect  of  human  error  on  system  performance,  the  relia¬ 
bility  of  the  equipment  under  test  must  be  factored  into  the  evaluation.  Because  of 
this,  it  was  decided  that  the  most  meaningful  statement  to  emerge  from  this  study 
would  be  the  probability  of  normally  functioning  equipment  being  on  the  vehicle 
when  it  undergoes  system  testing.  In  line  with  this  philosophy,  the  reliability 
figures  for  high-  and  low-flow  solenoids  were  obtained  and  combined  with  the  prob¬ 
ability  of  the  test  being  conducted  properly  When  this  calculation  was  made,  the 
number  that  emerged  was  0.  9975.  This  value  represents  the  probability  of  h  non¬ 
malfunctioning  set  of  valves  being  placed  on  the  vehicle  at  the  start  of  system 
testing  (See  Tables  3  and  4,  pages  11  and  12.) 
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For  a  malfunctioning  valve  to  be  placed  on  the  vehicle,  the  following  must  be  true 

a.  A  human  error  must  occur 
b  This  error  must  go  undetected 

c  This  error  must  be  made  on  a  test  of  a  malfunctioning  valve  such 
that  the  test  erroneously  pronounces  the  valve  to  be  good. 

2.3.6  MATHEMATICAL  RESULTS 

This  section  will  show  the  methods  of  calculating  test  reliabilities,  as  well  as  the 
results  of  the  various  calculations 

Table  1  (page  9)  is  a  listing  of  the  success  probabilities  for  each  step  in  the  task 
analysis,  along  with  the  the  total  success  probability  for  the  first  attempt.  The  success 
probabilities  for  each  task  were  obtained  by  using  the  numbers  contained  in  the 
DATA  STORE.  In  most  cases  the  values  given  in  the  DATA  STORE  for  the  various 
parameters  of  each  subtask  were  combined  by  multiplication  This  process  assumes 

that  all  of  the  parameters  are  operating  Independently  of  each  other. 

For  step  10e(l)  of  Appendix  B  (adjust  potentiometer),  a  different  method  of  combin¬ 
ing  probabilities  was  necessary  Normally,  this  potentiometer  does  not  have  to  be 
adjusted  since  the  required  5-volt  setting  is  never  changed.  Occasionally,  though, 
the  value  will  drift  or  someone  will  move  the  control  knob,  making  a  voltage  adjust¬ 
ment  necessary.  For  purposes  of  the  analysis,  it  was  assumed  that  this  task  would 
have  to  be  accomplished  every  fourth  time  the  recorder  was  turned  on  The  method 
of  calculating  the  success  probability  of  this  step  was  as  follows: 

a  Determine  the  success  probability  in  the  normal  manner;  i  e  ,  use  the 
values  in  the  DATA  STORE  and  combine  them  by  multiplication. 
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b.  Subtract  the  resulting  value,  0.  9980,  from  unity  to  find  the  probability 
of  failure;  i.  e. ,  0.  0020. 

c  Take  3/ 4ths  of  this  value;  i.e.  ,  0.0015 

d.  Subtract  this  value  from  unity;  i.e  ,  1,00  -0.0015  =  0  9995. 

e  Substitute  this  value  for  the  originally  obtained  value  on  the  step 

f.  Use  this  value  in  the  normal  manner  for  obtaining  total  success 
probability  on  step  10  (set  up  oscillograph  recorder) 


A  similar  method  was  used  in  the  calculation  of  the  success  probability  for  steps 
lOf  (set  up  traces  on  recorder)  and  18b  (set  automatic  Jelay  timers) 

Table  2  shows  the  probability  of  correcting  operator  errors.  The  first  column  lists 
the  success  probabilities  for  the  first  trial  of  each  step  in  the  task  analysis  All 
items  with  success  probabilities  below  0  9900  are  identified  by  asterisks.  The 
second  column  shows  the  probability  of  the  operator  correcting  errors  performed 
on  the  first  trial  Entries  ’/ere  made  in  this  column  only  if  the  value  was  less  than 
1  000  As  can  be  seen  from  the  table,  errors  on  only  12  of  the  steps  are  involved. 

The  third  column  represents  the  probability  of  the  record  reader  noticing  the  error 
made  by  the  operator.  In  most  cases,  the  only  corrective  action  open  at  this  time 
is  a  rerun  of  the  entire  test. 

Table  3  presents  the  data  used  to  determine  the  probability  of  correcting  errors 
Those  steps  of  the  task  analysis  that  have  not  been  included  in  the  analysis  were 
omitted  because  the  probability  of  their  being  discovered  and  corrected  by  the 
operator  was  1  000  and,  as  such,  they  would  not  affect  the  final  reliabilities  The 
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Tabic  1  Summary  of  Reliabilities  from  the  Task  Analysis  by  Steps 


Step 

Reliability 

Ste£ 

ReLabil  i 

1 

0  9960 

24 

0  8119 

2 

0  9886 

25 

0  9971 

3 

0.9722 

26 

0  8119 

4 

0.  9743 

27 

0.9971 

3 

0.9977 

28 

0  9975 

6 

0.9985 

29 

0. 9930 

7 

0.9991 

30 

0  9992 

8 

0.9985 

31 

0  9991 

9 

0.9985 

32 

0  9976 

10 

0.9711 

33 

0  9990 

11 

0.9038 

34 

0. 9934 

12 

0.9992 

39 

0. 8864 

13 

0.9900 

40 

0. 9898 

14 

0,9929 

41 

0  9947 

15 

0  9976 

42 

0  9968 

16 

0.9865 

43 

0. 8859 

17 

0  9901 

44 

0. 9990 

18 

0  9908 

45 

0  9971 

19 

0  9990 

46 

0  9992 

TOTAL  3681 


The  probability  of  successfully 
performing  the  functional  teEt 
oil  the  first  attempt  is  0  3681. 
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Table  2.  Probability  of  Correcting  Frrors 

Probability  of  Probability  of 

Correct  First-time  Operator  Correcting 

Accomplishment _  All  Errors  in  Task 

Probability  of 
Recorder  Reaik 
Catching  Error: 

1 

•  2 _ 

0.9960 

0.9886 

0.  9900 

1. 00 

•  3 

0  9722 

•  4 

0  9745 

5 

0.9977 

6 

0  9985 

7 

0.9991 

8 

0  9985 

9 

0.9985 

■SjvTJIV 

0.  9816 

0. 9990 

•u. 

0.9038 

0.  9784 

0. 0100 

12 

0. 9992 

13 

0  9900 

14 

0  9929 

15 

0.997G 

•  1G 

0  9865 

17 

0  9901 

0. 9999 

0.9999 

18 

0  9908 

0. 9976 

19 

0  9990 

•24 

0  8119  " 

| 

25 

0.9971 

)  Steps  24  and  26 

•26 

0  8119  - 

'  are  combined 

0  9800 

0  9900 

27 

0  9971 

0  9975 

0. 9508 

0  9900 

29 

0.9930 

30 

0  9992 

31 

0.9991 

0.9976 

0. 9999 

0  9999 

33 

0.9990 

34 

0.9934 

0. 9999 

•39 

0.8864  ^ 

40 

0  9898  | 

41 

0  9974 

^  Steps  39  and  43 

0  9999 

0. 9999 

42 

0  9968 

are  combined 

0  9999 

•43 

0  8859  J 

0. 9963 

0  00 

44 

0.9990 

45 

0  9971 

46 

0.9992 

•Reliability  below  0.9900 
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Table  3.  Probability  of  Correctly  Performing  the  Task 
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formulas  used  to  combine  the  data  are  shown  in  Table  4.  Examination  of  the  results 
(also  in  Table  +  )  shows  that  the  test  has  a  very  low  initial  reliability  (0  3681)  but  by 
the  time  all  of  the  checks  against  unreliability  have  been  applied,  the  final  reliability 
of  the  test  (0  979G)  is  respectably  high 

The  number  arrived  at  in  the  preceding  discussion,  0.9796.  represents  the  probability 
that  the  test  will  be  conducted  in  the  manner  intended  by  the  test  designer.  To  pre¬ 
dict  the  successful  performance  of  a  piece  of  hardware,  one  must  take  into  account 
two  other  factors  besides  the  efficiency  of  human  performance  These  two  factors 
are  the  reliability  of  the  equipment  itself  and  the  validity  of  the  test.  Test  validity 
means  the  probability  of  a  properly  conducted  test  detecting  malfunctions  in  the 
part  tested. 

Consultation  with  Reliability  personnel  reveals  that  the  expected  reliability  of 
solenoid  valves  is  as  follows 

High  flow  valves  0  9920 

Low  flow  valves  0  9890 

The  reliability  of  the  valves  when  combined  into  the  multi-valve  system  on  the 
vehicle  is  0.  8688 

Investigation  has  shown  that  no  attempt  has  been  made  to  quantify  the  effljiency  with 
which  the  subsystem  test  examines  valves  and  so,  for  purpose  of  the  present  study, 
the  reliability  of  the  test  itself  is  assumed  to  be  1  00 

Based  on  this  reasoning,  the  calculation  of  the  probability  of  non -malfunction big 
valves  being  introduced  into  the  system  lest  involves  combining  the  following  numbers 
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Human  reliability  0.9796 

Test  reliability  1.0000 

Valve  reliability  0.8688 

These  numbers  were  combined  by  means  of  standard  hardware  reliability  techniques, 
with  a  resultant  system  reliability  of  0  9970. 

2  3  7  VALIDATION  OF  PREDICTIONS 

An  attempt  was  made  to  vaMdate  the  predictions  made  in  Section  2  3  6  This  was 
done  by  examining  the  records  of  valve  failures  experienced  subsequent  to  system 
testing  The  results  of  this  examination  show  that  no  valve  failures  have  been 
experienced  to  date  Reliability  personnel,  at  the  request  of  the  author,  have 
estimated  a  success  probability  using  this  data  to  be  0.  9994  The  methods  outlined 
in  the  foregoing  discussion  predict  that  that  this  number  should  be  0  9970  It  is  felt 
that  present  data,  while  supporting  the  prediction  in  the  study,  are  Insufficient  for 
a  definitive  statement  concerning  the  validity  of  the  method. 
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SECTION  3 
DISCUSSION 


3.1  GENERAL 


As  part  of  this  study,  an  investigation  was  made  into  the  feasibility  of  applying  THERP 
and  DATA  STORE  to  test  activities.  As  was  indicated  in  Section  2,  evaluations  of  test 
procedures  can  be  accomplished  with  reasonable  speed.  The  results  of  such  analyses 
will  point  out  the  existence  of  ’’error-prone”  tasks  and  the  probability  of  failure  result¬ 
ing  from  human  errors  during  test  activities. 

The  initial  result  of  applying  DATA  STORE  numbers  was  a  low  probability  for  an 
errorless  test  performance.  Use  of  modified  THERP  techniques,  however,  indicated 
that  the  probability  of  human  errors  remaining  uncorrected  was  rather  low.  In  light 
of  this  result,  it  is  believed  that  the  procedure  used  on  future  studies  should  take  this 
probability  into  account.  A  pure  DATA  STORE  analysis  provides  the  probability  of 
no  errors  at  all  being  committed  during  a  test.  What  is  really  required  is  the  pro¬ 
bability  that  errors  would  be  committed  and  not  discovered.  In  line  with  this  require¬ 
ment,  the  following  procedure  is  recommended  for  future  quantification  efforts: 

a.  Define  the  test  to  be  evaluated. 

b.  Obtain  an  accurate  task  analysis  of  each  man  who  assists  in  performing 
the  test. 

c.  Review  each  task  analysis.  The  purpose  of  this  review  is  to  determine  which 
steps  are  insensitive  to  errors.  (A  step  that  is  insensitive  is  one  that  must 
be  performed  correctly  if  the  test  is  to  continue,  e.  g. ,  turning  on  a  piece 

of  equipment.)  The  probability  of  such  steps  being  correctly  performed  is 
1.0.  (If  such  a  procedure  had  been  used  on  the  study  reported  here,  only  12 
of  the  steps  in  the  task  analysis  of  At  pendix  B  would  have  required  evaluation.) 
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d.  Make  a  DATA  STORE  evaluation  of  the  sensitive  steps. 

e  Use  THERP  techniques  to  determine  the  probability  of  correcting  errors 
evaluated  in  step  d. 

f.  Combine  the  probabilities  in  step  e  into  a  probability  of  performing  the  test 
properly. 

If  the  techniques  of  this  paper  were  applied  to  an  entire  vehicle  test  program,  one 
could  make  statements  regarding  the  probability  of  an  uncorrected  human  error 
remaining  in  the  vehicle  at  launch  and  the  probability  of  such  an  error  causing  a 
flight  failure.  This  kind  of  data  would  permit  an  estimate  of  the  effectiveness  of  the 
testing  program  and  also  would  provide  an  indication  of  the  element  of  unreliability 
added  by  the  test  program.  At  the  present  time,  methods  of  reliability  assessment 
assume  that  human  actions  do  not  contribute  to  vehicle  unreliability  unless  a  failure 
due  to  human  error  has  actually  occurred.  Use  of  the  methods  described  in  this  repor 
does  not  fit  into  the  present  theory  of  reliability  assessment  which  stipulates,  essen¬ 
tially,  that  the  purpose  of  reliability  prediction  is  to  make  a  statement  about  the 
probability  of  a  vehicle  malfunctioning  in  the  next  few  seconds.given  "X"  amount  of 
running  time  on  its  components. 

The  following  paragraphs  describe  a  proposed  reliability  model  that  extends  the  presen 
theory  to  take  into  account  other  variables  besides  those  presently  considered. 

3.2  PROPOSED  RELIABILITY  SCHEME 

The  goal  of  a  reliability  program  should  be  a  statement  concerning  the  probability 
(and  nature)  of  flight  failures.  This  statement  should  take  into  account  the  following 
variables: 
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a.  Design  What  is  the  probability  oi  perfectly  functioning  equipment 
carrying  out  its  mission  tasks?  (Inherent  reliability) 

b  Manufacture:  W'hat  is  the  probability  that  the  equipment  can  be  made  exaotly 
to  the  design  specification? 

c.  Handling:  What  is  the  probability  that  the  perfectly  manufactured  equipment 
will  be  transposed  (without  degradation)  to  the  environment  in  which  it  must 
carry  out  its  duties? 

To  the  above  three  basic  variables,  one  must  add  a  fourth  which  enters  the 

picture  only  because  of  the  unreliabilities  of  the  preceding  items. 

d.  Test  Efficiency:  What  is  the  probability  that  test  activities  will  discover 
all  malfunctions,  potential  malfunctions,  or  out-of-specification  conditions? 

After  predictions  have  been  made  of  system  reliability,  these  predictions  should  then 
be  validated  and  upgraded  by  the  results  of  actual  performance  of  the  system  under 
consideration. 

To  the  author*  s  knowledge,  present  practice  of  reliability  engineering  makes  uee  of 
two  of  the  above  variables:  design  Information  and  records  of  actual  performance. 
These  data  are  used  to  generate  two  reliability  assessments,  which  are  demonstrated 
reliability  and  potential  reliability.  The  values  derived  from  the  two  sets  of  data  are 
usually  widely  discrepant  (i.e. ,  about  40  percentage  points).  Using  statistical  methods 
(Bayesian  theory) ,  the  two  numbers  can  be  combined  into  one  value  without,  however, 
making  use  of  any  new  data.  In  this  system,  testing  does  nothing  other  than  to  add 
running  time  to  vehicle  components. 
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The  effects  of  testing  on  the  reliability  assessment  should  be  more  than  a  simple 
accumulation  of  running  time  In  the  minds  of  the  people  who  are  responsible  for 
launching  a  vehicle,  testing  provides  the  necessary  confidence  that  there  are  no 
malfunctions  in  the  vehicle  and  that  it  is  Indeed  ready  for  its  mission.  The  confidence 
that  launch  personnel  have,  is  a  function  of  the  number  of  tests  that  the  vehicle  has 
successfully  survived.  The  more  tests  passed,  the  greater  their  confidence. 

A  quantification  method  should  be  evolved  which  uses  this  fact  as  part  of  its  model. 
That  is,  the  probability  of  success  at  time  of  launch  is  affected  as  each  test  is 
completed. 

The  formula  for  Reliability  might  be  as  follows 

R  *  f  (C  I) 

where 

R  =  Vehicle  reliability 

C  =  Confidence  that  all  components  are  working  and  are  connected  properly 
I  =  Inherent  reliability 

Inherent  reliability  is  essentially  a  definitive  function  that  varies  with  the  expected 
duration  of  a  mission,  it  can  range  from  zero  to  plus  one 

Confidence  is  a  number  that  can  vary  from  zero  to  one.  Hence  reliability  is  a  positive 
number  that  varies  from  zero  to  one. 

3.3  CONFIDENCE 

The  concept  of  confidence  as  treated  in  this  paper  is  relatively  new  and,  as  such, 
more  time  will  be  devoted  to  its  development.  In  the  past,  this  concept  has  been 


18 


discussed  but  little  has  been  done  toward  actually  measuring  it.  As  a  result  of  the 
de  velopment  of  the  techniques  outlined  in  this  report,  it  is  believed  that  many,  if  not 
all  the  obstacles,  have  been  removed  from  its  quantification. 

For  purposes  of  quantification,  confidence  can  be  broken  into  the  following  variables 

a  Manufacture  What  is  the  probability  that  the  device  will  be  exactly 
according  to  the  design  specification? 

b.  Handling  What  is  the  probability  that  the  equipment  will  be  handled 
(processed,  serviced,  and  tested)  without  damage  or  significant 
deterioration  of  performance. 

c.  Test  Efficiency  What  is  the  probability  that  the  test  program  will  discover 
all  malfunctions  in  the  equipment? 

At  the  present  time,  it  is  quite  possible  to  measure  the  first  two  variables  through 
use  of  the  data  in  the  DATA  STORE  and  in  Rook  (Reference  4). 

To  the  author's  knowledge  .little  or  no  work  has  been  done  to  quantify  test  efficiency. 
However,  with  variables  as  concrete  as  hardware  configuration,  data  flow,  test 
points,  and  test  procedure  to  work  with,  it  would  seem  not  too  difficult  for  some 
knowledgeable  person  to  devise  a  scheme  to  measure  test  efficiency. 

In  a  well  designed  testing  program,  the  curve  of  reliability  should  have  the  shape  of 
Figure  1  As  can  be  seen  from  this  figure,  there  is  an  abrupt  rise  in  the  curve  as  each 
test  in  the  prelaunch  cycle  is  complete.  If  the  test  program  is  properly  designed,  the  curve 
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T 


RELIABI  LI  T  Y 


should  become  asymptotic  to  the  inherent  reliability  as  the  vehicle  completes  the 
final  checks  before  launch.  Handling  of  the  vehicle  by  technical  personnel  will  incur 
a  risk  of  handling  damage;  hence,  the  curve  falls  slightly  during  the  interval  between 
tests. 


TIME 


Figure  1.  Curve  of  Expected  Reliability  Growth 


3.4  BENEFITS 


Application  of  the  reliability  scheme  outlined  in  the  preceding  section  could  be  expected 
to  provide  an  assessment  of  the  contribution  of  specific  tests  to  the  over  all  reliability 
of  a  system  It  will  enable  Management  to  eliminate  tests  that  are  not  contributing 
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to  reliability,  and  to  set  the  need  for  additional  tests  The  most  significant  asjxct 
of  the  reliability  model  is  that  it  simulates  actual  circumstances  Application  of 
this  model  to  a  system  could  be  expected  to  result  in  predictions  that  would  be  accurate 
for  the  first  flights  as  well  as  for  the  ultimate  flights  (as  predicted  by  inherent  reliability) 
This  statement  is  (>ossible  because  the  model  dot's  not  assume  away  variables  (i  e  , 
human  error  and  test  efficiency)  that  significantly  affect  reliability 

The  only  factor  which  prevents  immediate  application  of  this  model  to  a  system  is  the 
invention  of  a  method  for  quantifying  test  efflcieno"  And,  as  stated  previously,  this 
problem  should  prove  amenable  to  effort  by  knowledgeable  personnel. 


SECTION  4 


RESULTS 


As  a  result  of  this  analysis,  the  following  statements  can  be  made  The  importance 
of  these  statements  is  not  so  much  their  specific  content,  but  rather  the  fact  that 
these  types  of  statements  can  be  made  about  a  test  after  completion  of  such  an 
analysis 

a  The  probability  that  the  tester  will  complete  the  test  without  making  a 
single  error  is  0.3681 

b.  The  probability  that  the  operator  will  complete  the  test  properly  by 
correcting  all  errors  he  commits  is  0.9303. 

c.  The  probability  that  the  man  checking  the  results  of  the  test  will  detect 
errors  made  by  the  operator  is  0.6734. 

d.  The  probability  that  the  vehicle  will  be  properly  tested,  given  the 
above  variables,  is  0.9772. 

e.  13y  combining  human  reliability  with  equipment  reliability,  it  is  possible  to 
make  the  following  statement:  "The  probability  that  a  set  of  non -malfunctioning 
valves  will  enter  systems  testing  is  0.  9970.  " 
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SECT  ION  5 


CONCLUSIONS 

It  is  felt  that  the  basic  methods  developed  by  Payne  and  Altman  in  DATA  STORE,  and 
by  Rook  and  Swain  in  THERP,  can  be  applied  to  all  phases  of  human  factors  work 
Thus  far,  these  techniques  have  been  applied  to  electronic  equipment  operability 
(Payne  and  Aitman)  industrial  production  (Rook),  military  field  operations  (Swain); 
and,  in  this  study,  to  industrial  test  operations  It  would  seem  but  a  short  step  to 
apply  these  techniques  to  human  engineering  of  consoles  and  other  equipments 

These  methods  offer  human  factors  personnel  who  must  work  in  an  applied  setting, 
the  opportunity  to  progress  from  qualitative  statements  to  quantitative  statements 

The  words  of  Swain  (Reference  6)  sum  up  the  need  and  advantages  of  using  these 
techniques  rather  neatly  and  make  a  fitting  ending  to  this  paper: 

"In  the  meantime,  it  is  well  to  emphasize  that  THERP  is  strictly  an 
empirical  approach;  if  it  enables  us  to  make  predictions  sufficiently 
accurate  for  the  purpose  at  hand,  we  use  it.  We  are  far  from  being 
complacent  about  some  of  the  assumptions  we  have  to  make,  but  we 
have  reliability  problems  to  solve.  We  feel  that  using  the  data  we 
have  is  better  than  doing  nothing,  thereby  either  (1)  forcing  engineers 
or  others  not  trained  in  human  factors  technology  to  make  their  own 
estimates  of  human  reliability,  or  (2)  allowing  system  reliability 
equations  to  continue,  as  most  do,  to  assume  no  degradation  resulting 
from  the  human  element." 


n 
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APPENDlX  a 


DESCRIPTION  OF  METHODS  OF  QUANTIFYING  HUMAN  RELIABILITY 

A  1  DATA  STORE 


DATA  STORE  is  an  index  of  electronic  equipment  operability  developed  by  Daniel 
Payne  and  James  W  Altman,  while  working  at  the  American  Institute  for  Research. 
This  index  contains  quantitative  information  on  the  time  and  reliability  of  performing 
various  human  tasks.  The  individual  tasks  are  broken  up  into  small  segments  of 
behavior  that  lend  themselves  to  general  use  in  any  situation.  Examples  of  small 
segments  of  behavior  represented  in  DATA  STORE  might  be  reading  a  circular 
scale,  reading  a  label,  connecting  a  cable,  turning  a  crank,  positioning  an  object,  etc. 
For  purposes  of  quicker  evaluation,  the  tasks  are  broken  down  into  three  categories, 
input  or  sensing  tasks,  mediating  or  deciding  tasks,  and  output  or  control  tasks. 


A -1.1  SOURCE  OF  DATA 

The  numbers  used  in  DATA  STORE  were  gathered  from  a  search  of  thousands  of 
human  engineering  studies,  most  of  which  Involved  laboratory  research  The  error 
rates  obtained  from  these  laboratory  studies  seemed  to  be  grossly  high  for  a  direct 
estimate  of  operational  or  field  error  rates  Apparently  laboratory  workers,  in 
order  to  obtain  more  statistical  confidence  in  their  conclusions,  designed  tasks  to 
get  high  error  rates.  Whereas  in  the  operational  situation,  design  was  aimed  at 
obtaining  the  lowest  error  rate  possible  To  reconcile  these  differences,  past  field 
studies  were  examined  and  a  correction  factor  was  generated  which  was  then  applied 
to  all  laboratory  results  to  bring  them  more  in  line  with  field  experience. 

A-l  2  RESULTS 


Since  the  tasks  listed  in  the  DATA  STORE  are  not  gross  ones,  they  can  be  combined 
into  units  which  will  closely  approximate  almost  any  given  task  that  is  to  be  evaluated. 

A-l 
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Reliability  scores  obtained  through  use  of  the  DATA  STORE  method  are  the  product 
of  individual  reliability  estimates  A  basic  assumption  made  when  using  the  method  is 
that  all  tasks  are  independent  of  each  other. 

The  information  obtained  from  a  DATA  STORE  analysis  cun  be  used  to  pinpoint 
problem  areas  because  it  provides  individual  scores  tor  all  tasks  and  their  elements, 
as  well  as  a  total  score.  With  this  data,  one  can  examine  the  total  task  for  those 
elements  which  contribute  the  greatest  amount  to  unreliability  so  that  corrective 
attention  can  be  focused  on  them. 

Once  corrective  actions  are  proposed,  a  DATA  STORE  ANALYSIS  can  be  performed 
on  the  changes  to  determine  the  alteration  in  task  reliability  to  be  expected  from  the 
proposed  changes.  For  further  information,  see  Payne  and  Altman  (Reference  2) 

A-2.  THERP 

THERP  (Technique  for  Human  Error  Rate  Prediction)  is  a  method  for  performing  a 
human  factors  reliability  analysis  which  has  been  used  since  1961  by  the  Reliability 
Department  at  Sandia  Corporation.  The  analysis  has  been  employed  primarily  to 
provide  quantitative  predictions  of  degradation  to  a  man/  machine  system  resulting 
from  human  errors  Application  of  the  THERP  method  involves  the  following  steps 

a.  Define  the  system  or  subsystem  failure  to  be  evaluated. 

b.  Identify  all  important  human  operations  performed  and  their  relationships 
to  system  tasks  and  functions. 

c.  Predict  error  rates  for  each  human  operation. 

d.  Determine  the  effect  of  human  errors  on  the  system 
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e.  Recommend  changes  as  necessary  to  reduce  the  system  or  subsystem 
failure  rate  as  a  consequence  of  the  estimated  effects  of  the  changes. 

The  THERP  method  revolves  around  the  construction  of  a  logic  box  diagram  of  paths 
to  system  success.  Human  errors  require  shifting  to  alternate  |>aths.  That  is,  given 
a  human  error,  what  additional  actions  are  necessary  to  correct  that  error  if  the 
system  is  to  complete  its  mission  successfully?  Each  branch  of  the  logic  box  must 
then  bo  assigned  a  probability  of  successful  completion.  Assignment  of  values  to  each 
branch  must  take  into  account  problems  of  dependence  versus  independence  of  events, 
and  the  effects  of  stress,  climate,  motivation  and  a  host  of  other  variables  which 
affect  human  performance  and  decision  making.  The  model  can  easily  be  expanded  to 
include  equipment  reliability  predictions  in  order  to  faoilitatc  tradeoffs  between 
manual  or  automatic  modes  of  operation.  Thus  it  can  be  a  valuable  tool  in  functions 
allocation  early  in  the  life  of  a  system. 

For  further  information,  see  Rook  (Reference  4)  and  Swain  (Reference  5). 
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APPENDIX  B 


TASK  ANALYSIS  OF  PNEUMATICS  FUNCTIONAL  TEST* 


The  following  material  is  a  reproduction  of  the  task  analysis  used  in  this  study.  To  the 
left  of  each  step  can  be  found  the  calculated  DATA  STORE  reliability  for  that  step. 
Numbers  indented  from  the  left  side  are  values  for  parts  of  a  step.  The  value  for  the 
total  step  is  usually  obtained  by  multiplying  the  values  for  all  parts  of  the  step. 


Reliability 


Step 


0  9960 

0.9987 
0. 9973 


1.  Turn  on  power  to  oscillograph  recorder  (if  not  already  on)- 

a.  Throw  ON/ OFF  toggle  switch  up. 

b.  Push  red  button  on  console  (1  of  6  buttons) 


0.9886 


0  9989 
0  9994 


2.  Connect  test  cables  to  the  pressure  transducers  and  solenoids 
(19  cable  sets): 

a  Position  test  cables. 

b  Connect  cables 


0.9722 


3.  Connect  the  nitrogen  high-pressure-leak-rate  system  to  the 
fill  line. 


0  9952 

a.  Short 

pneumatics  line  to  Millapore  filter  : 

0  9989 

(1) 

Remove  cap. 

0-9988 

(2) 

Put  on  seal  ring. 

0  9991 

(3) 

Put  pneumatics  line  over  connection. 

0.9996 

(4) 

Start  connection  with  fingers 

0.9988 

(5) 

Tighten  with  two  wrenches  (7/8  inch,  open-end) 

0  8952 

b.  Millapore  filter 

For  reliability 

(1) 

Remove  cap  on  filter  fitting. 

values,  see 

(2) 

Put  on  seal  ring. 

step  3a. 

(3) 

Put  pneumatics  line  over  connection. 

(4) 

Start  connection  with  fingers 

(5) 

Tighten  connection  with  two  wrenches. 

‘This  tept  is  defined  by  Standing  Instruction  238131,  Section  3.  3 
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PNEUMATICS  FUNCTIONAL  TEST  (Continued) 


Reliability 

0.9952 

0.9864 

0.9944 
0  9972 

0  9976 
0.9996 

0.  9948 

0.9993 

0.9992 

0.9963 

0.9745 

0  9981 
0. 9863 

0.9977 

0  9992 
0  9985 

0.9985 

0  9991 


Step 

c.  Filter  to  floor  (line  about  5  feet  long) 

Same  as  in  step  3b. 

d.  Pneumatics  line  to  Schrader  valve  on  vehicle  (line  about 
15  feet  long): 

(1)  Attach  the  long  line  at  the  AGE  end 

(2)  Purge  the  system: 

(a)  Set  the  regulator  at  100  psi. 

(b)  Let  gas  flow  through  system  for  short  period 
of  time. 

(3)  Attach  the  pneumatics  line  to  the  vehicle  Shrader 
valve: 

(a)  Remove  the  cap  on  the  Shrader  valve. 

(b)  Remove  the  cap  on  the  pneumatics  line. 

(c)  Proceed  as  described  in  steps  3a  (2)  through 
3c  (5). 

.  Open  the  nitrogen  line  valve: 

a.  Check  gauge  to  determine  what  pressure  is  in  the  source. 

b.  Crack  tile  nitrogen  valve  and  watch  the  pressure  mount  on 
gauge  to  5500  psi. 

.  Open  the  nitrogen  shutoff  valve 
a  Check  that  the  vent  valve  is  closed 
b.  Open  the  nitrogen  valve. 

.  Open  the  nitrogen  high-pressure-leak-rate  system  shutoff 
valve: 

a  Crack  the  valve  slowly,  then  open  it  (twist  counterclockwise) 

.  Open  the  Shrader  valve  on  the  vehicle: 

a.  Using  open-end  wrench,  turn  valve  counterclockwise 
two  and  one-half  turns. 
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PNEUMATICS  FUNCTIONAL  TEST  (Continued) 


Reliability 

0  9985 


8. 


Step 

Open  the  leak- rate  shutoff  valve  on  the  console  in  the  test 
control  room 


a 

Twist  the  valve  counterclockwise 

0  9985 

9  Open  the  nitrogen  high-pressure-leak-rate  system 

shutoff  valve: 

a. 

Twist  the  valve  counterclockwise. 

Q. 971 1 

10  Set  up  the  oscillograph  recorder  (to  be  done  prior  to  each 
test  requiring  its  use): 

0. 9990 

a. 

Flip  POWER  ON  toggle  switch  up.  Allow  one  hour  for 
warmup. 

0.9978 

b 

Push  the  POWER  ON  indicator  button.  Check  to  see  if 
the  indicator  next  to  it  goes  on.  If  not,  repeat  step  10a 

0. 9990 

c. 

Turn  on  the  power  supply: 

(1)  Flip  toggle  switch  up 

0.  9827 

d. 

Adjust  power  to  5  volts 

0  9995 

(1)  Adjust  coarse  potentiometer. 

0.9832 

(2)  Check  reading  on  meter 

0.9900 

e. 

Check  that  the  timing  lines  on  the  recorder  are  correct: 

0.9982 

(1)  Set  selector  (4 -position  switch)  on  1  line  per 
second. 

0.9929 

(2)  Run  short  record  check  to  determine  that  one 
timing  line  per  second  is  indicated: 

0.9996 

(a)  Check  manual  toggle  switch 

0.9965 

(b)  Push  1  SEC  ON/ OFF  button. 

0.9968 

(c)  Turn  off  recorder. 

0.  9934 

f . 

Set  up  the  proper  traces  on  the  recorder: 

0.9980 

(1)  Pull  the  recorder  half  way  out  of  the  cabinet. 

0.9999 

(2)  Open  the  access  door  on  top  of  the  recorder  box. 
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PNEUMATICS  FUNCTIONAL  TEST  (Continued) 


Reliability  Step 


0.9997 

(3) 

Check  the  listing  of  the  light  spots  desired  for 
functions  to  be  read  out. 

0.9997 

H) 

If  not  set  up  correctly,  disconnect  or  connect 
proper  pins  ith  adjustment  tool  (maximum  of 
four  pins  two  put  in,  two  pulled  out). 

0.9993 

(5) 

Check  location  of  spots  of  light  on  the  record. 

0.9999 

(6) 

If  not  correct,  remove  adjustment  tool. 

0.  9983 

(7) 

Move  lights  to  correct  position  on  the  chart. 

0.9999 

(8) 

Move  extra  spots  off  chart. 

0.9999 

(9) 

Replace  adjustment  tool. 

0.9999 

(10) 

Close  access  door. 

0.9980 

(11) 

Push  box  back  into  console. 

0.9038  11.  Calibrate  the  recorder 


0.  9993 

a. 

Check  that  the  timing  mark  selector  is  set  correctly 
(4 -position  selector) 

0. 9976 

b. 

Set  up  the  desired  pressure  on  the  gauge. 

0.9993 

c. 

Record  pressure  used  on  record  paper. 

0.  9965 

d. 

Push  1  SEC  button  and  ON/ OFF  button  to  start  record. 

0. 9968 

e. 

Push  ON/  OFF  button  to  stop  record 

0.  9999 

f. 

Check  the  record  for  proper  pressure  indication. 

0. 9309 

g- 

Return  to  step  lib  and  repeat  steps  lib  through  Ilf 
in  10-pound  increments  until  the  low-pressure  regulator 
locks  out,  i.e. ,  the  line  shows  no  change  between  the 
last  pressure  and  the  present  reading.  (Range  of  values 
should  be  from  zero  to  70  pounds  pressure.) 

0.9917 

h. 

When  the  low-pressure  regulator  locks  out,  switch 
Millipore  filters: 

0.9985 

(1)  Lower  all  pressure  in  system  to  ambient  by 

opening  leak-rate  valve  until  gauge  reads  zero 
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PNEUMATICS  FUNCTIONAL  TEST  (Continued) 


Reliability 


Step 


0  9996 

(2) 

Push  one  or  two  solenoid  buttons  at  random  to 
vent  off  any  residual  pressure  in  the  system 

0.9936 

(3) 

Switch  the  Millapore  filter  from  the  low-pressure 
to  the  high-pressure  system 

0. 9984 

(a)  Remove  one  fitting  with  two  wrenches 

0.9952 

(b)  Fasten  filter  to  bulkhead  fitting. 

0. 9930 

(c)  Fasten  new  filter  to  high-pressure  fitting 
(see  step  3) 

0.9930 

(d)  Fasten  filter  to  pneumatics  line  to  vehicle. 

0.9799  i.  Return  to  step  lib  and  continue  calibration  of  the 

high-pressure  regulator  pressure  in  increments  of 
100  pounds  until  regulator  locks  out.  Usually  two 
readings  are  required:  400  psi  and  500  psi. 

0.9988  j.  Check  the  record  to  ensure  proper  operation  of  the 

regulators. 


0.  9992  12.  After  calibration  of  the  recorder,  detach  the  record  and 

store  it. 

a.  Rethread  the  paper  in  the  recorder. 


0.9900 

0.9976 

0.9924 


13.  Pressurize  the  system  with  nitrogen: 

a.  Open  the  leak -rate  high-pressure  regulator. 

b.  Observe  the  high  pressure  gauge. 


0.9929 


14.  Check  the  pressure  downstream  of  the  regulators. 


For  reliability 
values,  see  step 
10f(2) 


a.  Take  an  oscillograph  reading  to  verify  the  pressure 

(1)  Push  1  SEC  button. 

(2)  Push  ON/  OFF  button . 

(3)  Push  ON/ OFF  button  again  to  stop  record 

b.  Check  the  record  to  verify  proper  lockout  pressures, 
1.  e. ,  no  change  in  lockout  lines. 
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PNEUMATICS  FUNCTIONAL  TEST  (Continued) 


Reliability 

Step 

0.9976 

15. 

Turn  on  the  high-  and  low-pressure  stabilization  control 

POWER  ON  switches. 

0.9977 

a. 

Flip  two  toggles  switches  up 

0.9999 

b. 

Observe  indicator  going  on  above  switch. 

0.9865 

16. 

Purge  high-  and  low-flow  nozzles: 

0.9970 

a. 

Press  solenoid  microswitches  (16  switches)  for  no 
longer  than  a  few  seconds  each. 

0.9999 

b. 

Observe  Indicator  on  each  switch  as  it  is  pressed  and 
listen  for  swish  of  gas. 

0.9901 

17. 

Pressurize  the  system  to  3500  psi: 

For  reliability 

a. 

Open  the  leak-rate  high-pressure  regulator. 

values,  see 
step  lib,  11c. 

b. 

Watch  pressure  gauge  rise  until  it  reads  3500  psi. 

c. 

Observe  traces  on  the  recorder.  Traces  must  rise 

above  lockout  levels: 

(1)  Write  pressure  on  the  record. 

(2)  Press  1  SEC  button. 

(3)  Press  ON/  OFF  button  to  start  record. 

(4)  Press  ON/  OFF  button  to  stop  record. 

18. 

Set  up  the  timers  on  the  calibration  panel  (to  be  done  twice 
during  the  test  for  regulators  for  solenoids): 

0.9974 

a. 

Check  that  paper  supply  on  recorder  is  adequate. 

0.9997 

b. 

Check  that  delay  timer  is  set  for  more  than  0.  15 
second 

0. 9990 

c. 

Check  that  recorder  timer  is  set  to  read  more  tha  i 

0. 15  second. 

0  9990 

d. 

Check  that  solenoid  timer  is  set  to  read  more  than 

0.  80  second. 
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0.9742 

0.9845 

0.8996 

0.9738 

0.9239 

0.9703 

0.8119 

0.9698 

0.8372 

0  9971 

0.9976 

0.9999 


Step 

e  Check  that  the  settings  on  record  speed  controls 
are  correct: 

(1)  Observe  4-position  dial  (set  at  100) 

(2)  Observe  six-button  complex  (button  for  16 
inches  should  be  depressed). 

19.  Flip  solenoid  toggle  switch  to  the  timer  position  (down) 
a.  Observe  indicator  going  on. 

20.  Check  Standing  Instruction  238131,  Section  3.3  for 
proper  combination  of  solenoid  switches. 

21.  Record  combination  of  solenoids  on  record. 

22.  Press  combination  of  solenoid  buttons  specified  in 
SI  238131  (Section  3.  3)  and  hold  them  down. 

a.  Input  from  SI. 

b.  Press  and  hold  buttons. 

23.  Press  TIMER  START  button  (at  times,  two  men  are 
required  to  accomplish  this  task). 

24.  Repeat  steps  22  and  23  for  all  20  combinations  specified 
in  the  SI: 

a.  Check  that  pressure  remains  at  3500  psi  throughout 
testing. 

b.  See  steps  20  through  23. 

25.  Vent  the  system  pressure  to  1000  psi: 

a.  Close  leak-rate  high-pressure  regulator. 

b.  Press  solenoids  on  high-pressure  side. 
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PNEUMATICS  FUNCTIONAL  TEST  (Continued) 


Reliability 

0.9996 

0.9976 

0.8119 

0.9971 

0.9972 

0.9999 

0.9975 

0. 9982 

0.9993 

0.9930 

0.  9965 
0.9965 

0.9992 

0  9991 

0.9976 

See  step  3d(2) 
and  3d(9)  for 
reliabilities 


Step 

c.  Observe  pressure  decay  on  gauge.  When  pressure 
is  zero,  release  solenoid  buttons. 

d.  Adjust  leak-rate  regulator  to  build  pressure  up  to 
1000  psi. 

26.  Repeat  the  sequence  of  solenoid  tests  (steps  20  through 
25)  for  20  sequences. 

27.  Vent  system  to  ambient 

a.  Open  leak-rate?  valve. 

b.  Press  solenoids  at  random. 

28.  Shift  recorder  speed  to  a  slower  rate: 

a.  Move  selector  switch  to  10  degrees  (4-position 
switch) 

b.  Use  a  pen  to  identify  the  record. 

29.  Run  off  a  short  strip  of  record 

a.  Press  ON/ OFF  button  to  start  the  recorder. 

b.  Press  ON/  OFF  button  to  stop  the  recorder. 

30.  Remove  the  record  ar.d  store  it. 

31.  Rethread  a  new  record  in  the  recorder. 

32.  Repressurize  the  system  to  3500  psi 

a.  Open  the  regulator  valve. 

b.  Watch  gauge  until  it  reads  3500  psi 

c.  Adjust  valve  to  hold  this  pressure. 
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PNEUMATICS  FUNCTIONAL  TEST  (Continued) 


Reliability 


Step 


0  JJ990  33.  Check  the  position  of  the  solenoid  switch. 

a.  Switch  should  be  in  the  dowm  position  (on  TIME 
position). 

0  9934  34.  Check  and  adjust  the  recorder  channels  (See  steps  lOe 

and  llg). 


0.9991 


35.  Check  SI  238131  for  proper  solenoid  button. 


0.9993 


36.  Record  solenoid  "A"  number  on  recorder  chart. 


0.9956 


37.  Hold  down  proper  solenoid  button  (these  buttons  do  not 
follow  in  order  of  console  placement) 


0.9985 


38.  Press  TIME  START  button  on  recorder  console  and  release 
both  buttons. 


0.9864 


39.  Perform  steps  35  through  38  for  all  16  solenoids. 


0.  9898  40.  When  test  is  complete  at  high  pressure,  run  recorder  at 

slow  speed  to  identify  end  of  record; 


0.  9924 

a. 

Reset  speed  dia  (4-position  dial). 

0.  9990 

b. 

Flip  toggle  switch  to  MANUAL 

0.  9994 

c. 

Write  identification  on  record. 

0.  9965 

d. 

Press  ON/  OFF  button  to  start  record. 

0.  9965 

e. 

Press  ON/  OFF  button  to  stop  record. 

0.9947 

41.  Vent  the  system  to  1000  psi: 

For  reliabilities 

a. 

Close  leak-rate  high-pressure  regulator. 

see  step  25 

b. 

Check  recorder  to  determine  that  it  is  in  manual  mode 

c. 

Press  solenoid  buttons  at  random  to  speed  venting 

of  system. 
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PNEUMATICS  FUNCTIONAL  TEST  (Continued) 


Reliability 


0. 9968 


0. 9990 
0.9984 
0.9994 


Step 

d.  Observe  decay  of  pressure  on  gauge. 

e.  Adjust  leak-rate  regulator  to  provide  1000  psi 
in  system. 

f.  Check  gauge  reading  for  1000  psi. 

42.  Check  to  ensure  that  recorder  is  ready  for  low-pressure 
run: 

a.  Toggle  switch  in  timer  mode. 

b.  Speed  setting  on  64  lines  per  second. 

c.  Identify  run  on  record  with  per. 


0.8859 


43.  Repeat  testing  of  solenoids  (steps  36  through  40)  for 
16  switches. 


0.9990 


44.  Put  recorder  toggle  switch  in  MANUAL  position. 


0.9971 

0.9976 

0.9995 


45.  Vent  system  to  ambient 

a.  Open  leak-rate  regulator  valve. 

b.  Press  high-pressure  solenoid  buttons  at  random 
until  gauge  reads  zero  pressure. 


0.9992 


46.  Detach  record  and  store  it. 


END  OF  TEST 


